ecryptfs: use after free
The "full_alg_name" variable is used on a couple error paths, so we shouldn't free it until the end. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: stable@kernel.org Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
This commit is contained in:
parent
4aa25bcb7d
commit
ece550f51b
|
@ -1748,7 +1748,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
|
||||||
char *cipher_name, size_t *key_size)
|
char *cipher_name, size_t *key_size)
|
||||||
{
|
{
|
||||||
char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
|
char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
|
||||||
char *full_alg_name;
|
char *full_alg_name = NULL;
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
*key_tfm = NULL;
|
*key_tfm = NULL;
|
||||||
|
@ -1763,7 +1763,6 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
|
||||||
if (rc)
|
if (rc)
|
||||||
goto out;
|
goto out;
|
||||||
*key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
|
*key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
|
||||||
kfree(full_alg_name);
|
|
||||||
if (IS_ERR(*key_tfm)) {
|
if (IS_ERR(*key_tfm)) {
|
||||||
rc = PTR_ERR(*key_tfm);
|
rc = PTR_ERR(*key_tfm);
|
||||||
printk(KERN_ERR "Unable to allocate crypto cipher with name "
|
printk(KERN_ERR "Unable to allocate crypto cipher with name "
|
||||||
|
@ -1786,6 +1785,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
out:
|
out:
|
||||||
|
kfree(full_alg_name);
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue